libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream() and ttadecoderprocessframe() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.